blax-meta-quip-biz[.]pages[.]dev

This domain, blax-meta-quip-biz.pages.dev, was registered on February 21, 2026 through Cloudflare, Inc. The authoritative nameservers are arya.ns.cloudflare.com and alberto.ns.cloudflare.com, indicating the domain is hosted behind Cloudflare's edge network. DNS resolution returns the IPv6 address 2a06:98c1:3121::3, which is announced by AS13335, a Cloudflare infrastructure located in the United States. An HTTP request to the host returns status code 403 and the page title “Suspected phishing site | Cloudflare”, suggesting that the site has been taken down or is being blocked by Cloudflare's protective services. The SSL certificate presented is issued by Google Trust Services under the WE1 identifier, confirming the use of a legitimate TLS chain. Threat intelligence flags the domain as a credential‑phishing operation.

Fourteen of ninety‑three security vendors on VirusTotal have reported it as malicious, and it is listed on one public blocklist maintained by PhishDestroy. Independent reputation services assign extremely low trust scores (1/100 on ScamAdviser and 0/100 on Gridinsoft), reinforcing the malicious assessment. Detected technologies include HTTP/3, HSTS, and Cloudflare’s CDN, which are commonly employed to improve performance and evade simple network‑level filters. The current status is offline, which limits visible payloads, but the presence of a phishing‑specific page title and the blocklist entry indicate that the domain was actively used to harvest credentials before takedown.

No additional indicators such as specific target brands, phishing kits, or payload URLs are available from the provided data, leaving the exact phishing vector and victim profile uncertain. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration attempts, and enforce outbound filtering for connections to Cloudflare‑hosted IP ranges that resolve to similar suspicious domains.